selinux September 2007

selinux@lists.fedoraproject.org

37 participants
47 discussions

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

udev/sound/alsa: needs to read /var/lib/alsa/asound.state (alsa_var_lib_t)
by Tom London 15 Oct '07

15 Oct '07

Running latest rawhide, targeted enforcing. Booting up, udev (90-alsa.rulles) runs /sbin/salsa to read /var/lib/alsa/asound.state. Get these in /var/log/messages: Sep 25 06:48:13 localhost kernel: audit(1190728078.763:6): avc: denied { read } for pid=1789 comm="salsa" name="asound.state" dev=dm-0 ino=688429 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:alsa_var_lib_t:s0 tclass=file Sep 25 06:55:25 localhost kernel: audit(1190728512.708:5): avc: denied { getattr } for pid=1793 comm="salsa" path="/var/lib/alsa/asound.state" dev=dm-0 ino=688429 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:alsa_var_lib_t:s0 tclass=file tom [Sorry if I incompletely reported this before, since policy now allows directory to be read. There was a change in alsa-utils that mistakenly moved 'salsa' to /bin/salsa, so I stopped gettting AVCs. alsa-utils fixed now.] -- Tom London

3 4

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

dhclient-script avc error f7
by Tim Fenn 05 Oct '07

05 Oct '07

I recently upgraded a machine from FC6 to F7, and I used to use a /etc/dhclient-exit-hooks script to call some iptables functions after bringing up my external interface. This used to work on FC6 as long as I setsebool -P dhcpc_disable_trans 1, but the policy in F7 no longer contains such a boolean, so dhclient-script is prevented from getattr/executing iptables. Is there a simple fix to this, or do I need to write a policy and compile it? If the latter, any pointers on what the policy file should contain? Thanks for any help, tim

2 4

logrotate and /var/log/rpmpkgs ....
by Tom London 02 Oct '07

02 Oct '07

Running latest Rawhide, targeted/enforcing. When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs: type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null) Should there be a directory in /var/log for these logs (with the appropriate label)? tom -- Tom London

3 4

tmpreaper and /var/cache/man
by Tom London 01 Oct '07

01 Oct '07

Running latest Rawhide, targeted/enforcing. tmpreaper is complaining about /var/cache/man: /etc/cron.daily/tmpwatch: error: opendir error on current directory /var/cache/man/cat1: Permission denied error: cleanup failed in /var/cache/man/cat1: Permission denied error: opendir error on current directory /var/cache/man/cat2: Permission denied error: cleanup failed in /var/cache/man/cat2: Permission denied error: opendir error on current directory /var/cache/man/cat3: Permission denied error: cleanup failed in /var/cache/man/cat3: Permission denied error: opendir error on current directory /var/cache/man/cat4: Permission denied error: cleanup failed in /var/cache/man/cat4: Permission denied <<<<<SNIP>>>>> and type=AVC msg=audit(1191001312.606:91): avc: denied { read } for pid=12019 comm="tmpwatch" name="cat9" dev=dm-0 ino=65624 scontext=system_u:system_r:tmpreaper_t:s0 tcontext=system_u:object_r:man_t:s0 tclass=dir type=SYSCALL msg=audit(1191001312.606:91): arch=40000003 syscall=5 success=no exit=-13 a0=804ac12 a1=98800 a2=fd00 a3=0 items=0 ppid=11987 pid=12019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0 key=(null) type=AVC msg=audit(1191001312.608:92): avc: denied { read } for pid=12020 comm="tmpwatch" name="catn" dev=dm-0 ino=65625 scontext=system_u:system_r:tmpreaper_t:s0 tcontext=system_u:object_r:man_t:s0 tclass=dir type=SYSCALL msg=audit(1191001312.608:92): arch=40000003 syscall=5 success=no exit=-13 a0=804ac12 a1=98800 a2=fd00 a3=0 items=0 ppid=11987 pid=12020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0 key=(null) or #============= tmpreaper_t ============== allow tmpreaper_t man_t:dir read; [Guessing it wants more than just 'read'.....] tom -- Tom London

2 1

Allowing httpd to connect to specific sockets
by Jason L Tibbitts III 28 Sep '07

28 Sep '07

So I have this AVC: avc: denied { name_connect } for pid=9045 comm="httpd" dest=9680 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket which comes from a PHP script trying to open a socket. This is no big deal. I believe that setting httpd_can_network_connect should fix it. However, I was wondering if it's possible to restrict the destination port to 9680, or restrict the destination host at all? - J<

3 5

loopback mounting public_content_t (iso images)
by Chuck Anderson 28 Sep '07

28 Sep '07

When I reboot my mirror server, I always get these avc's and it fails to automatically mount my iso's: Sep 27 10:30:33 sinclair kernel: audit(1190903394.348:4): avc: denied { read } for pid=4163 comm="mount" name="enigma-i386-disc1.iso" dev=dm-6 ino=191775508 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:public_content_t:s0 tclass=file Here is the corresponding entry from /etc/fstab: /srv/ftp/pub/linux/distributions/redhat/linux/7.2/en/iso/i386/enigma-i386-disc1.iso /srv/ftp/pub/mnt/enigma-i386-disc1 iso9660 ro,context=system_u:object_r:public_content_t,loop=/dev/loop10,nosuid,nodev 0 0 I tried something like this in /etc/rc.d/rc.local: # make loop devices 0-199 and redo mount /usr/local/sbin/mkloops mount -a Where "mkloops" does this: #!/bin/bash #set -x for i in 0 1; do for j in 0 1 2 3 4 5 6 7 8 9; do for k in 0 1 2 3 4 5 6 7 8 9; do n=$(echo ${i}${j}${k} | sed -e's/^0\+//g') [ -z $n ] && n=0 [ ! -e /dev/loop${n} ] && mknod -m 0640 /dev/loop${n} b 7 ${n} chown root:disk /dev/loop${n} done done done Any suggestions on how to allow a file to be loop mounted and also shared via FTP/HTTP/RSYNC? Thanks.

2 3

.if installation
by Rob Myers 28 Sep '07

28 Sep '07

hello it seems like selinux policy module rpms should install their interfaces into /usr/share/selinux/devel/include, but this is missing from http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules. are there negative consequences of doing so? see the suggested changes below. rob. --- PackagingDrafts-SELinux-PolicyModules.txt.orig 2007-09-27 10:03:39.000000000 -0400 +++ PackagingDrafts-SELinux-PolicyModules.txt 2007-09-27 10:12:38.000000000 -0400 @@ -321,7 +321,7 @@ BuildRequires: checkpolicy, selinux-pol Requires: selinux-policy >= %{selinux_policyver} %endif Requires: %{name} = %{version}-%{release} -Requires(post): /usr/sbin/semodule, /sbin/restorecon +Requires(post): /usr/sbin/semodule, /sbin/restorecon, /usr/bin/sepolgen-ifgen Requires(postun): /usr/sbin/semodule, /sbin/restorecon %description selinux @@ -360,6 +360,11 @@ do done cd - +# Install SELinux interfaces +install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 SELinux/%{modulename}.if \ + %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if + # Hardlink identical policy module packages together /usr/sbin/hardlink -cv %{buildroot}%{_datadir}/selinux @@ -375,6 +380,8 @@ do done # Fix up non-standard directory context /sbin/restorecon %{_localstatedir}/cache/myapp || : +# Regenerate interfaces information for polgen +/usr/bin/sepolgen-ifgen || : %postun selinux # Clean up after package removal @@ -398,6 +405,7 @@ fi %defattr(-,root,root,0755) %doc SELinux/* %{_datadir}/selinux/*/%{modulename}.pp +%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if %changelog * Mon Jul 31 2006 John Doe <doe(a)example.com> 0.01-1 @@ -425,7 +433,8 @@ BuildRequires: checkpolicy, selinux-pol %if "%{selinux_policyver}" != "" Requires: selinux-policy >= %{selinux_policyver} %endif -Requires(post): /usr/sbin/semodule, /sbin/fixfiles, myapp +Requires(post): /usr/sbin/semodule, /sbin/fixfiles, /usr/bin/sepolgen-ifgen +Requires(post): myapp Requires(postun): /usr/sbin/semodule %prep @@ -461,6 +470,11 @@ do done cd - +# Install SELinux interfaces +install -d %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 SELinux/%{modulename}.if \ + %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if + # Hardlink identical policy module packages together /usr/sbin/hardlink -cv %{buildroot}%{_datadir}/selinux @@ -476,6 +490,8 @@ do done # Fix up non-standard directory context /sbin/fixfiles -R myapp restore || : +# Regenerate interfaces information for polgen +/usr/bin/sepolgen-ifgen || : %postun # Clean up after package removal @@ -492,6 +508,7 @@ fi %doc ChangeLog AUTHOR COPYING SELinux/* %{_bindir}/myapp %{_datadir}/selinux/*/%{modulename}.pp +%{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if %changelog * Mon Jul 31 2006 John Doe <doe(a)example.com> 0.01-1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux September 2007